fix: enforce settings authority boundaries (#618)

Close generic settings authorization bypasses and enforce per-setting authority, validation, redaction, transactional config import, and route-local write rate limiting.

tests/integration/platform/api-key-scoping.test.ts

@@ -77,7 +77,7 @@ describe("API key permission scoping", () => {
       method: "PUT",
       url: "/api/v1/settings",
       headers: { authorization: `Bearer ${apiKey}` },
-      payload: { testSetting: "hacked" },
+      payload: { defaultTheme: "dark" },
     });
     expect(writeRes.statusCode).toBe(403);
   });
@@ -96,7 +96,7 @@ describe("API key permission scoping", () => {
       method: "PUT",
       url: "/api/v1/settings",
       headers: { authorization: `Bearer ${body.key}` },
-      payload: { testSetting: "value" },
+      payload: { defaultTheme: "dark" },
     });
     expect(writeRes.statusCode).toBe(200);
   });